DayTailor Privacy Policy
DayTailor ("Tailor your day.") is a daily planning and focus app for iPhone. This policy says exactly what information DayTailor handles, where it goes, why, and what you can do about it. It is written to match what the app actually does. If the app changes, this document changes with it.
1. The short version
- Your work lives on your device and in your DayTailor account. Tasks, plans, focus sessions, daily receipts, and — with Pro — destinations, milestones, steps and journey entries are stored on your device and synced to your account so they are the same on every device you sign in on.
- We do not sell your data, show you advertising, or track you across other apps or websites. DayTailor contains no advertising, no analytics service and no crash-reporting service.
- AI is optional and off until you turn it on. If you turn it on, the specific text described in section 5 is sent to OpenAI to be processed. Nothing is sent before you agree, and you can turn it off at any time. If you are 13–17, a parent or guardian has to say yes first (section 9).
- DayTailor is for people aged 13 and over. We do not knowingly hold an account for anyone younger (section 9).
- Payments are handled by Apple. DayTailor never sees your card or bank details.
- You can delete your account from inside the app, which permanently removes your account and everything in it from our systems.
2. Who we are and how to reach us
DayTailor is published and operated by Sufiya Anjum Khadri, an individual in New Jersey, United States. She is the person legally responsible for the app, for this policy and for the accounts behind it, and she is who "we" and "us" mean throughout.
DayTailor was created by Syed Murtuza Khadri, who designed and built it. That is a credit for the work, not a statement about who holds the data: he is not the operator, not the publisher and not a controller of your information.
For anything about this policy, your data, or a request to access or delete it, write to murtuza.smkhadri@gmail.com. The support page explains what to send and what to expect. The same address is shown at the foot of Settings in the app. Privacy requests, deletion problems, guardian questions, data-copy requests and security reports are handled by the publisher; the creator may assist with the technical side at her direction.
3. Information DayTailor handles
3.1 Your account
When you sign in with Apple or Google, DayTailor creates an account for you in our authentication service (Supabase, see section 7). The account holds:
- a DayTailor account identifier (a random ID we generate),
- the email address your sign-in provider gives us. With Sign in with Apple you may choose "Hide My Email", in which case we receive a relay address that Apple manages rather than your real one,
- the identity provider you used and the identifier that provider uses for you,
- the profile fields the provider includes in its sign-in token. For Google this includes your name and a link to your profile picture. DayTailor does not use or display these; they are recorded by the authentication service because Google sends them. Sign in with Apple sends no name, because DayTailor does not ask for one,
- sign-in session records and their timestamps, including the IP address and the app or browser details your device presents when it signs in, which the authentication service records for session security.
DayTailor asks Apple only for your email address, not your name.
3.2 Your work
Everything you create in DayTailor is stored on your device and synced to your account. That is:
| What | Details |
|---|---|
| Tasks | Title, category, priority, planned length, deadline, the day you planned to do it and any start time you chose, when it was completed |
| Checklists | The items on a task and whether each is done |
| Repeating tasks | The rules that create tasks on a schedule |
| Focus sessions ("Lock In") | Which task, when it started and ended, how long it ran |
| Daily receipts | The day's totals and the reflection you wrote |
| Preferences | When your day starts and ends, your minimum break, which categories you use, sound settings, and whether you have completed onboarding |
| Destinations (Pro, "Future") | Title, why it matters, the artwork and colour you chose, status, target date |
| Milestones and steps (Pro) | Titles, notes, target dates, whether they are done |
| Journey entries (Pro) | The record of what happened on a destination, including notes you write |
Things you delete are marked as deleted so that the deletion syncs to your other devices. Those markers stay in your account until the account itself is deleted, and are not shown anywhere.
3.3 Information that stays on your device only
- Notifications are scheduled on the device. DayTailor does not use a push-notification server; no notification content leaves the device.
- Live Activities and widgets (the Lock Screen focus timer, the Home Screen widgets) read from the copy of your data on the device. Nothing they show is sent anywhere.
- Appearance and onboarding state are kept in the app's local settings.
3.4 Purchases
If you subscribe to DayTailor Pro, the purchase is made through Apple's App Store. Apple handles payment, billing and refunds under Apple's own terms and privacy policy. DayTailor never receives your card number, bank details or Apple payment credentials.
To make Pro work on all your devices, the app sends Apple's signed record of the purchase to our server, which verifies Apple's signature and keeps a record containing: Apple's transaction identifier for the subscription, the product bought, when the current period ends, whether Apple has reported it refunded, and whether it came from Apple's production or test environment. This record is what tells our server that your account is entitled to Pro. It contains no payment details.
3.5 AI usage records
If you use AI features, our server keeps a log entry for each request: which feature, when, the outcome (accepted, succeeded, failed, or refused), how many characters were sent and how many tokens came back, the model used, how long it took, and whether your account was Free or Pro at the time. The log never contains what you wrote or what the model replied. Its purpose is to enforce the monthly allowance and to detect abuse.
We also record whether you have agreed to AI processing, which version of the disclosure you agreed to, when, and whether you have since withdrawn.
If you report an AI response (section 5.5), we keep which response it was, the reason you chose from a short list, and when. If you are 13–17 and OpenAI's safety check flags a request or an answer (section 5.4), we keep which request it was, whether it was the request or the answer, the category labels the check returned, and when. Neither record contains the text.
3.6 Your age range
When you first sign in, DayTailor asks which of three ranges you are in — under 13, 13–17, or 18 or over — and keeps that answer, when you gave it, and which version of our age policy applied.
On iOS 26 and later, DayTailor also asks iOS whether your Apple Account has an age range recorded on it, which you or a parent may have set. If iOS shares one, we use it to pre-select an answer on that same question — we do not submit it for you. The screen tells you the answer came from your Apple Account, and you can change it before continuing; if it is wrong, pick your real age. What we keep is the range you confirmed and whether it was the one iOS suggested. We do not keep what iOS sent us, and iOS never sends us a date of birth — only a range.
We never ask for or store your date of birth. DayTailor does not verify your age, and nothing in the app treats your answer as verified. You can later change your answer to a more restrictive range, but not to a less restrictive one; the app says so on the screen. See section 9.
3.7 A parent or guardian's permission (13–17 only)
If you are 13–17 and want to use AI, DayTailor asks you for a parent or guardian's email address, emails them a link, and keeps: that address, when the link was sent and when it expires, whether and when they gave permission, whether and when they withdrew it, and which version of the disclosure they saw. The links themselves are random codes that are never stored — only a one-way hash of each is. The permission link works once and expires after 72 hours; the withdrawal link stays valid so that permission can be withdrawn at any time. We keep nothing else about your parent or guardian.
3.8 What DayTailor does not collect
No location, contacts, photos, microphone, health data, or advertising identifier. No analytics or usage-tracking service. No crash-reporting service. DayTailor does not track you across apps or websites and does not use Apple's App Tracking Transparency because there is nothing to ask for.
4. How we use information
- To run the app: storing, syncing and showing your work across your devices.
- To sign you in and keep you signed in.
- To honour your Pro subscription on every device you use.
- To provide the AI features you ask for, when you have turned them on (section 5).
- To enforce the monthly AI allowance and protect the service from abuse.
- To answer you when you contact us.
We do not use your information for advertising, profiling, or to train any model of our own.
5. AI features
AI in DayTailor is optional, off by default, and only ever runs when you ask it to. Before it can run for the first time, the app shows you a consent screen that says what will be sent and where. You can turn AI off at any time in Settings › AI, which stops anything new from being sent.
If you are 13–17, AI features are available only after a parent or guardian has given permission through the emailed link described in section 3.7, and after you have agreed to the same consent screen everyone sees. Every other part of DayTailor — including DayTailor Pro — works without AI, before, during and after that.
5.1 What is sent, and when
| Feature | When it runs | What is sent |
|---|---|---|
| Brain Dump (Capture) | When you tap to turn a brain dump into tasks | The text you wrote |
| Plan suggestion | When you ask for a suggested order for the day | The titles, categories, lengths and identifiers of the tasks being planned |
| Weekly reflection | When you ask for it on Progress | Counts and totals for the week, and two sentences DayTailor composed from them. No task titles |
| Future suggestions (Pro) | When you tap "Suggest milestones" or "Break this down" | The destination's title, why it matters, its target year, the titles of its existing milestones, and the milestone being broken down |
Nothing else is sent. No notes, no history, no journey entries, no account details. Your sign-in token is never sent to the AI provider.
5.2 Who processes it
The text goes from your device to our server, and from our server to OpenAI. OpenAI's published Data Processing Addendum designates OpenAI OpCo, LLC as the contracting party for customers outside the European Economic Area and Switzerland, which is where DayTailor's publisher is. OpenAI runs the model. Our server adds the instructions, checks the reply, and returns only the structured result to your device. Nothing is created in your account until you review and approve it.
With each request our server also sends OpenAI a safety identifier: a one-way hash derived from your DayTailor account identifier, so that OpenAI's abuse detection can tell requests from the same account apart without receiving your account identifier, your email, or anything else about you.
5.3 What OpenAI does with it
We ask OpenAI not to store requests or responses for later retrieval (the API's store: false setting). OpenAI states that it does not use API content to train its models by default, and that it may retain API content for up to 30 days to monitor for abuse and misuse, after which it is deleted unless the law requires otherwise. Content flagged by that monitoring may be reviewed by OpenAI's authorised personnel or a moderation sub-processor. OpenAI processes this under its Services Agreement and its Data Processing Addendum. DayTailor has not enabled OpenAI's zero-data-retention option and does not claim it.
5.4 Safety checks for users aged 13–17
If your account is a 13–17 account, every AI request is also passed through OpenAI's moderation model on the way in and on the way out, in the same request. If either is flagged, DayTailor does not show the answer, tells you it could not make a suggestion from that text, and records the category labels described in section 3.5. The moderation model returns labels, not the text.
5.5 Reporting a response
Beside every AI response there is a "Report" control. Choosing a reason records which response it was and why; it does not send the text anywhere again. Reports and safety records are stored with your account so that the publisher can examine them. Reporting does not change what DayTailor shows you, and DayTailor does not promise a reply to a report or a review within any particular time.
5.6 Withdrawing
Turning AI off stops any new request. It cannot recall what was already sent; that is governed by OpenAI's terms above. Withdrawing consent is recorded on our server; if the consent text changes materially you will be asked again before AI runs. A parent or guardian can withdraw their permission at any time from the link in the email DayTailor sent them; AI stops immediately and the rest of DayTailor is unaffected.
6. Where information is stored, and for how long
| Where | What | How long |
|---|---|---|
| Your device | Everything in section 3.2 and your settings | Until you delete the app or delete your account. If you back up your device (iCloud or a computer), the backup contains the app's data under Apple's backup terms until that backup is replaced or deleted |
| Your device's keychain | Your sign-in session | Until you sign out or delete your account. iOS keeps keychain items when an app is removed, so reinstalling DayTailor may sign you straight back in |
| DayTailor account (Supabase) | Everything in sections 3.1, 3.2, 3.4, 3.5, 3.6 and 3.7 | Until you delete your account. Deleted items are kept as deletion markers until then |
| OpenAI | The text in section 5.1 and the safety identifier in 5.2, for the requests you make | Not stored for retrieval; abuse-monitoring copies for up to 30 days — see 5.3 |
| Apple | Your purchase and subscription | Per Apple's terms; Apple's records are Apple's |
| Our authentication provider's own event log | A record that a sign-in event happened, kept by the authentication service rather than by DayTailor. It contains no task text or other content from the app. This table held no entries at all for DayTailor when we last checked it, and the provider publishes no retention period for it; it is not linked to your account record, so deleting your account does not necessarily remove any entry that does exist | Not stated by the provider; not controlled by us |
| Server logs | Operational log lines for our server functions. They can include your account identifier and the outcome of a request, and never include your content | Retained by our hosting provider for its log retention period — currently one day |
| Backups | Database backups taken by our hosting provider | There are no automatic backups on the current hosting plan. If that changes, a deleted account is absent from any backup taken after deletion and leaves earlier backups when they expire |
7. Who receives information
We use these providers to run DayTailor. Each receives only what is needed for its job.
| Provider | What it receives | Why |
|---|---|---|
| Supabase, Inc. | Your account (3.1), your synced work (3.2), your purchase record (3.4), AI usage records (3.5) | Hosts the account database, authentication and our server functions |
| OpenAI | The text in section 5.1 and a hashed account identifier, only when you use an AI feature; for 13–17 accounts, the same text is also checked by OpenAI's moderation model | Runs the AI model and, for 13–17 accounts, the safety check |
| Google LLC — Sign in with Google | The fact that you signed in to DayTailor with your Google account | Only if you choose Google to sign in |
| Apple Inc. | Your sign-in (if you choose Apple), your purchase, and the app's normal operation on your device | Sign in with Apple, the App Store, StoreKit |
| Sinch Mailjet | A parent or guardian's email address and the permission email sent to it (section 3.7) | Delivers the permission and withdrawal emails |
| Cloudflare, Inc. | The ordinary web-server record of a visit — IP address, browser type, time — when a parent or guardian opens the permission or withdrawal page, or anyone reads this policy or the Terms. The permission code in the link is never sent to Cloudflare (it travels in the part of the address browsers keep to themselves) | Hosts the permission pages and these documents |
We have no advertising partners, no analytics partners and no data brokers. We do not sell personal information and have not done so.
Each of these providers processes data on our instructions, under its own terms and data processing agreement. The DayTailor database is hosted by Supabase, Inc. in its us-east-2 region (Ohio, United States); DayTailor is sold in the United States, and if you use it from elsewhere your data is transferred there. OpenAI processes AI requests under its Services Agreement and Data Processing Addendum. Mailjet, which is operated by Sinch, processes the parent-or-guardian email under its own terms. Cloudflare hosts these pages under its own terms.
8. Your choices and rights
- See your data. Everything DayTailor holds about your work is visible in the app. For a copy of your account data, write to murtuza.smkhadri@gmail.com from the email address on your DayTailor account — that is how we confirm the request is yours — and we will provide it, normally within 30 days. We ask for nothing else: no identity document, no security questions, because collecting more about you in order to answer a privacy request would defeat the point. If you can no longer use that address we cannot confirm the request is yours, and we will say so; you can still delete the account and everything in it from inside the app. There is no in-app export feature, and we do not promise one: if you want a copy, the route above is the route. Where the law gives you a right to receive your information in a portable form, we handle that through the same verified request.
- Correct it. Edit anything in the app; the change syncs to your account. Your age range is used only to decide which features are available to you and is not used for anything else.
- Turn AI off. Settings › AI › Turn off AI.
- Delete your account. Settings › Account › Delete account. This permanently deletes your account and everything in sections 3.1, 3.2 and 3.4 to 3.7 from our database in a single operation, and removes the data from the device you are using. It cannot be undone. The one thing that operation does not reach is the authentication service's own record that a sign-in happened, described in section 6 — we do not control it, it is not joined to your account record, and it holds nothing you wrote in the app. If you signed in with Apple, the app asks you to confirm with Apple once more so that DayTailor can also revoke its Sign in with Apple authorization; if that step cannot complete, your account is still deleted and the app tells you how to remove DayTailor from your Apple Account settings by hand. Deleting the account does not cancel an App Store subscription — Apple bills that, and you cancel it in Settings › Apple Account › Subscriptions on your device.
- Sign out without deleting anything: Settings › Account › Sign out.
- Parents and guardians. If you gave or withdrew permission for a 13–17 account, you can withdraw it at any time from the link in the email we sent you. For anything else about that permission — including a copy of the record described in section 3.7 — write to murtuza.smkhadri@gmail.com from the address the permission email was sent to.
- Messages you send us are kept for as long as needed to answer them and to keep a record of requests about your data; you can ask us to delete them once your request is closed.
Depending on where you live, you may have legal rights to access, correct, delete, restrict or port your personal information, or to object to certain processing, and to complain to a supervisory authority. To exercise any right, contact murtuza.smkhadri@gmail.com.
9. Age
DayTailor is for anyone with a demanding week — students, professionals, parents — and is not directed at children.
- You must be at least 13 to use DayTailor. We do not knowingly hold an account for anyone under 13. If we learn that an account belongs to someone under 13 we will delete the account and everything in it, as described in section 8. If you believe a child under 13 has created an account, contact murtuza.smkhadri@gmail.com.
- If you are 13–17. You can use everything in DayTailor, including DayTailor Pro. AI features need a parent or guardian's permission first (sections 3.7 and 5), then your own agreement on the consent screen, and every AI request is safety-checked (section 5.4). Your parent or guardian can withdraw their permission at any time, and it stops applying from the next AI request on.
- If you are 18 or over. AI features are available after the consent screen.
- What we store about your age. Only which of three ranges you chose — under 13, 13–17, or 18 or over — together with when you chose it and which version of this policy applied (section 3.6). We do not ask for or store your date of birth. DayTailor does not verify age.
10. Security
Data in transit to our servers and to the AI provider is encrypted with TLS. Your account data is protected by row-level security so that only your own account can read or write it. Our server functions never hold a privileged database key that the app could reach, the AI provider key exists only on the server, and purchase entitlements are verified against Apple's signature on the server rather than trusted from the app. No system is perfectly secure; if we learn of a breach affecting your data we will tell you as the law requires.
11. Changes to this policy
We will post any change here with a new effective date. For a change that materially affects you, the app shows a notice the next time you open it, and the updated policy stays one tap away in Settings. We do not send marketing or bulk email and have no mechanism to email every user, so we do not promise one. If a change materially affects how AI processes your data, the app asks for your consent again before AI runs.